B2B Collaboration Guest Cannot Reach a Shared Team
Fabrikam collaborates with a partner, Northwind. Northwind users are invited as guests into Fabrikam's Microsoft Entra tenant. A new project requires 60 Northwind users to access a Microsoft Teams team and a SharePoint site. Fabrikam's external collaboration settings allow guests to be invited by all users, with no restrictions on domains. A Conditional Access policy requires multifactor authentication for all guest users. Northwind has its own Microsoft Entra tenant with MFA enforced for its users. After invitations are accepted, 18 Northwind users can open the team but cannot open the SharePoint site, and 6 users cannot sign in at all and receive an error about the invitation. Fabrikam's identity admin assumed that because Northwind enforces MFA, Fabrikam's guest MFA policy would be satisfied automatically.
1. Assess the admin's MFA assumption and explain what actually determines whether a guest satisfies Fabrikam's MFA requirement.
Read the worked answer
The assumption is wrong as stated. A guest's home-tenant MFA does not automatically satisfy a resource tenant's Conditional Access MFA requirement. What matters is whether the authentication event is recognized as having satisfied MFA in the resource tenant's evaluation. Microsoft Entra cross-tenant access settings and the trust settings configured for the partner determine whether MFA claims from the home tenant are accepted. If trust settings for Northwind are not configured to trust multifactor authentication, Fabrikam's policy will require the guest to complete MFA in Fabrikam's tenant, and users who have not registered a method there will be blocked.
So the fix is configuration, not assumption: review cross-tenant access settings for Northwind, decide whether to trust its MFA claim, and if not, plan for guest MFA registration. The 6 users who cannot sign in likely have unredeemed or expired invitations and should be re-invited.
2. The 18 users who reach Teams but not SharePoint need a diagnosis path. Describe how you would isolate the cause using entitlement and access review evidence.
Read the worked answer
Teams access and SharePoint access are granted through different paths, so a difference points at authorization rather than authentication. Work through it in order.
First, confirm the users are authenticating successfully: if they open Teams, the guest account and MFA are working, which rules out the sign-in layer.
Second, check group membership and entitlement. The team may grant access through a Microsoft 365 group or team membership, while the SharePoint site uses a separate site membership or a SharePoint group. Verify whether the 18 users are members of the team but absent from the site's members. If an access package is used, check that the package includes the SharePoint site as a resource and that the assignment is in the delivered state.
Third, check sharing settings on the site itself: external sharing may be limited at the site level even though tenant-level guest settings are permissive. Site-level sharing settings override tenant defaults.
Finally, use access reviews to confirm the intended population still has legitimate access, and record the finding so the next project provisions both resources through one entitlement rather than two unrelated grants.